-
Notifications
You must be signed in to change notification settings - Fork 58
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1293 from SEKOIA-IO/update-intake-documentation
Refresh intakes documentation
- Loading branch information
Showing
2 changed files
with
174 additions
and
15 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -40,21 +40,24 @@ Find below few samples of events and how they are normalized by Sekoia.io. | |
| "file" | ||
| ], | ||
| "type": [ | ||
| "access", | ||
| "change" | ||
| ] | ||
| ], | ||
| "action": "edit", | ||
| "dataset": "audit#activity" | ||
| }, | ||
| "@timestamp": "2014-03-17T15:39:18.460000Z", | ||
| "user": { | ||
| "id": "ABC123xyz", | ||
| "email": "[email protected]" | ||
| }, | ||
| "google-drive-reports": { | ||
| "actor": { | ||
| "email": "[email protected]" | ||
| }, | ||
| "parameters": { | ||
| "visibility": "shared_internally" | ||
| "google": { | ||
| "report": { | ||
| "actor": { | ||
| "email": "[email protected]" | ||
| }, | ||
| "parameters": { | ||
| "visibility": "shared_internally" | ||
| } | ||
| } | ||
| }, | ||
| "network": { | ||
|
|
@@ -95,18 +98,21 @@ Find below few samples of events and how they are normalized by Sekoia.io. | |
| "file" | ||
| ], | ||
| "type": [ | ||
| "access", | ||
| "change" | ||
| ] | ||
| ], | ||
| "action": "edit", | ||
| "dataset": "audit#activity" | ||
| }, | ||
| "@timestamp": "2014-03-17T15:39:18.460000Z", | ||
| "user": { | ||
| "id": "ABC123xyz", | ||
| "email": "[email protected]" | ||
| }, | ||
| "google-drive-reports": { | ||
| "actor": { | ||
| "email": "[email protected]" | ||
| "google": { | ||
| "report": { | ||
| "actor": { | ||
| "email": "[email protected]" | ||
| } | ||
| } | ||
| }, | ||
| "network": { | ||
|
|
@@ -134,6 +140,63 @@ Find below few samples of events and how they are normalized by Sekoia.io. | |
| ``` | ||
|
|
||
|
|
||
| === "test_drive_view_document.json" | ||
|
|
||
| ```json | ||
|
|
||
| { | ||
| "message": "{\n \"kind\": \"admin#reports#activity\",\n \"id\": {\n \"time\": \"2023-09-04T08:42:51.615Z\",\n \"uniqueQualifier\": \"-2222222222222222222\",\n \"applicationName\": \"drive\",\n \"customerId\": \"111111111\"\n },\n \"actor\": {\n \"email\": \"[email protected]\",\n \"profileId\": \"444444444444444444444\"\n },\n \"ipAddress\": \"1.2.3.4\",\n \"events\": [\n {\n \"type\": \"access\",\n \"name\": \"view\",\n \"parameters\": [\n {\n \"name\": \"primary_event\",\n \"boolValue\": true\n },\n {\n \"name\": \"billable\",\n \"boolValue\": true\n },\n {\n \"name\": \"owner_is_shared_drive\",\n \"boolValue\": true\n },\n {\n \"name\": \"owner_team_drive_id\",\n \"value\": \"DDD_111111111111111\"\n },\n {\n \"name\": \"owner\",\n \"value\": \"J.DOE\"\n },\n {\n \"name\": \"doc_id\",\n \"value\": \"333333333333333333333333333333333\"\n },\n {\n \"name\": \"doc_type\",\n \"value\": \"folder\"\n },\n {\n \"name\": \"is_encrypted\",\n \"boolValue\": false\n },\n {\n \"name\": \"doc_title\",\n \"value\": \"MyDocs\"\n },\n {\n \"name\": \"visibility\",\n \"value\": \"people_within_domain_with_link\"\n },\n {\n \"name\": \"shared_drive_id\",\n \"value\": \"DDD_222222222222222\"\n },\n {\n \"name\": \"originating_app_id\",\n \"value\": \"666666666666\"\n },\n {\n \"name\": \"actor_is_collaborator_account\",\n \"boolValue\": false\n },\n {\n \"name\": \"owner_is_team_drive\",\n \"boolValue\": true\n },\n {\n \"name\": \"team_drive_id\",\n \"value\": \"DDD_888888888888888\"\n }\n ]\n }\n ]\n}\n", | ||
| "event": { | ||
| "kind": "event", | ||
| "category": [ | ||
| "file" | ||
| ], | ||
| "type": [ | ||
| "access" | ||
| ], | ||
| "action": "view", | ||
| "dataset": "admin#reports#activity" | ||
| }, | ||
| "@timestamp": "2023-09-04T08:42:51.615000Z", | ||
| "user": { | ||
| "id": "111111111" | ||
| }, | ||
| "google": { | ||
| "report": { | ||
| "actor": { | ||
| "email": "[email protected]" | ||
| }, | ||
| "parameters": { | ||
| "visibility": "people_within_domain_with_link" | ||
| } | ||
| } | ||
| }, | ||
| "network": { | ||
| "application": "drive" | ||
| }, | ||
| "source": { | ||
| "ip": "1.2.3.4", | ||
| "address": "1.2.3.4" | ||
| }, | ||
| "file": { | ||
| "gid": "DDD_111111111111111", | ||
| "owner": "J.DOE", | ||
| "type": "folder", | ||
| "name": "MyDocs" | ||
| }, | ||
| "related": { | ||
| "user": [ | ||
| "J.DOE" | ||
| ], | ||
| "ip": [ | ||
| "1.2.3.4" | ||
| ] | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
@@ -144,15 +207,17 @@ The following table lists the fields that are extracted, normalized under the EC | |
| | Name | Type | Description | | ||
| | ---- | ---- | ---------------------------| | ||
| |`@timestamp` | `date` | Date/time when the event originated. | | ||
| |`event.action` | `keyword` | The action captured by the event. | | ||
| |`event.category` | `keyword` | Event category. The second categorization field in the hierarchy. | | ||
| |`event.dataset` | `keyword` | Name of the dataset. | | ||
| |`event.kind` | `keyword` | The kind of the event. The highest categorization field in the hierarchy. | | ||
| |`event.type` | `keyword` | Event type. The third categorization field in the hierarchy. | | ||
| |`file.gid` | `keyword` | Primary group ID (GID) of the file. | | ||
| |`file.name` | `keyword` | Name of the file including the extension, without the directory. | | ||
| |`file.owner` | `keyword` | File owner's username. | | ||
| |`file.type` | `keyword` | File type (file, dir, or symlink). | | ||
| |`google-drive-reports.actor.email` | `keyword` | Drive actor email | | ||
| |`google-drive-reports.parameters.visibility` | `keyword` | Visibility of the Drive item associated with the activity | | ||
| |`google.report.actor.email` | `keyword` | Drive actor email | | ||
| |`google.report.parameters.visibility` | `keyword` | Visibility of the Drive item associated with the activity | | ||
| |`network.application` | `keyword` | Application level protocol name. | | ||
| |`source.ip` | `ip` | IP address of the source. | | ||
| |`user.email` | `keyword` | User email address. | | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters